// 

// — 010 Editor v3.1.3 Binary Template 
// 

// File: 

// Author: 

// Revision: 

// Purpose: 

// 

typedef unsigned long ULONG; 
typedef unsigned short USHORT ; 
typedef short OFFSET; 
typedef DWORD SECT; 
typedef DWORD FSINDEX; 
typedef USHORT FSOFFSET ; 
typedef ULONG DFSIGNATURE; 
typedef ULONG DFSIGNATURE; 
typedef unsigned char BYTE; 
typedef unsigned short WORD; 
typedef unsigned long DWORD; 
typedef WORD DFPROPTYPE; 
typedef ULONG SID; 

struct FILE 

{ 

Struct STRUCTURED_STORAGE_HEADER 

{ 

BYTE Signature[8] ; 

BYTE CLSID[16] ; 

USHORT MinorVersion; 

USHORT MajorVersion; 

USHORT ByteOrder; 

USHORT SectorShift; 

USHORT MiniSectorShift; 

BYTE HeaderReserved[6] ; 

DWORD NumberOfDirectorySectors <bgcolor=cLtBlue> 
DWORD NumberOf FATSectors <bgcolor=cRed>; 

DWORD FirstDirectorySectorLocation ; 

DWORD TransactionSignatureNumber ; 

DWORD MiniStreamCutoffSize; 

DWORD FirstMiniFATSector <bgcolor=cGreen>; 

DWORD NumberOf MiniFATSectors <bgcolor=cYellow>; 
DWORD FirstDIFATSector; 

DWORD NumberOf DIFATSectors; 

DWORD DIFAT[109] ; 

} header <bgcolor=cLtGray>; 
struct File_Information_Block 
{ 

struct FibBase 

{ 

USHORT wld; 

USHORT nFib; 

USHORT unused; 

USHORT lid; 

USHORT pnNext ; 
unsigned char flagsl; 
unsigned char flags2; 

USHORT nFibBack; 

ULONG IKey; 



char flags3; 

USHORT reserved3; 

USHORT reserved4; 

ULONG reserved5; 

ULONG reserved6; 

}fibbase <bgcolor=cAqua>; 

USHORT csw; 
struct FibRgW97 
{ 

USHORT rl; 

USHORT r2; 

USHORT r3; 

USHORT r4; 

USHORT r5; 

USHORT r6; 

USHORT r7 ; 

USHORT r8; 

USHORT r9; 

USHORT rl0; 

USHORT rll; 

USHORT rl2; 

USHORT rl3; 

USHORT lidFE; 

}fibRgW97 <bgcolor=cPurple>; 

USHORT cslw; 

struct FibRgLw97 

{ 

ULONG cbMac; 

ULONG rl; 

ULONG r2; 

ULONG CCpText ; 

ULONG ccpFtn; 

ULONG ccpHdd ; 

ULONG r3; 

ULONG ccpAtn; 

ULONG ccpEdn ; 

ULONG CCpTxbx; 

ULONG ccpHdrTxbx; 

ULONG r4; 

ULONG r5; 

ULONG r6; 

ULONG r7 ; 

ULONG r8; 

ULONG r9; 

ULONG rlO; 

ULONG rll; 

ULONG rl2; 

ULONG rl3; 

ULONG rl4; 

}fibRgLw97 <bgcolor=cYellow>; 

USHORT cbRgFcLcb; 

if (file . fib . cbRgFcLcb == 183)//112-B7 

{ 


struct FibRgFcLcb2007 
{ 



struct FibRgFcLcb2003 rgFcLcb2003; 
ULONG fcPlcfmthd ; 

ULONG lcbPlcfmthd ; 

ULONG fcSttbf BkmkMoveFrom; 

ULONG lcbSttbfBkmkMoveFrom; 

ULONG fcPlcBkfMoveFrom; 

ULONG lcbPlcBkfMoveFrom; 

ULONG fcPlcBklMoveFrom; 

ULONG lcbPlcf BklMoveFrom; 

ULONG fcSttbf BkmkMoveTo; 

ULONG lcbSttbf BkmkMoveTo; 

ULONG fcPlcBkfMoveTo; 

ULONG lcbPlcBkfMoveTo; 

ULONG fcPlcBklMoveTo; 

ULONG lcbPlcf BklMoveTo; 

ULONG fcUnusedl; 

ULONG lcbUnusedl; 

ULONG fcUnused2; 

ULONG lcbUnused2; 

ULONG fcUnused3; 

ULONG lcbUnused3; 

ULONG fcStbfBkmkArto; 

ULONG lcbSttbf BkmkAr to; 

ULONG fcPlcfBkfArto; 

ULONG lcbPlcBkfArto; 

ULONG fcPlcfBklArto; 

ULONG lcbPlcfBklArto; 

ULONG fcArtoData; 

ULONG lcbArtoData; 

ULONG fcUnused4; 

ULONG lcbUnused4; 

ULONG fcUnused5; 

ULONG lcbUnused5; 

ULONG fcUnused6; 

ULONG lcbUnused6; 

ULONG fcOssTheme; 

ULONG lcbOssTheme; 

ULONG fcColorSchemingMapping; 

ULONG lcbColorSchemeMapping; 

} fibRgFcLcb2007 ; 


} 

if (file . fib . cbRgFcLcb == 164)//10C-A4 

{ 

struct FibRgFcLcb2003 

{ 


struct FibRgFcLcb2002 rgFcLcb2002; 
ULONG fcHplxsdr ; 

ULONG lcbHplxsdr ; 

ULONG fcSttbf BkmkSdt ; 

ULONG lcbSttbf BkmkSdt; 

ULONG fcPlcBkfSdt ; 

ULONG lcbPlcBkfSdt ; 

ULONG fcPlcBklSdt ; 

ULONG lcbPlcBklSdt ; 

ULONG fcCustomXForm; 

ULONG lcbCustomXForm; 



ULONG fcSttbBkmkProt ; 

ULONG lcbSttbBkmkProt ; 
ULONG fcPlcBkf Prot ; 

ULONG lcbPlcBkf Prot ; 

ULONG fcPlcBklProt ; 

ULONG lcbPlcBklProt ; 

ULONG fcSttbProtUser ; 

ULONG lcbSttbProtUser ; 
ULONG fcUnused ; 

ULONG lcbUnused; 

ULONG fcPlcf pmiOld; 

ULONG lcbPlcf pmiOld ; 

ULONG fcPlcfpmiOldlnline; 
ULONG lcbPlcf pmiOldlnline; 
ULONG fcPlcfpmiNew; 

ULONG lcbPlcf pmiNew; 

ULONG fcPlcfpmiNewInline; 
ULONG lcbPlcf pmiNewInline; 
ULONG fcPlcf IvcOld ; 

ULONG lcbPlcf IvcOld; 

ULONG fcPlcflvcOldlnline; 
ULONG lcbPlcf lvcOldlnline; 
ULONG fcPlcflvcNew; 

ULONG lcbPlcflvcNew; 

ULONG fcPlcflvcNewInline; 
ULONG lcbPlcf IvcNewInline; 
ULONG fcPgdMother; 

ULONG lcbPgdMother ; 

ULONG fcBkdMother ; 

ULONG lcbBkdMother ; 

ULONG fcAfdMother ; 

ULONG lcbAfdMother ; 

ULONG fcPgdFtn; 

ULONG lcbPgdFtn; 

ULONG fcBkdFtn; 

ULONG lcbBkdFtn; 

ULONG fcAfdFtn; 

ULONG lcbAfdFtn; 

ULONG fcPgdEdn ; 

ULONG lcbPgdEdn ; 

ULONG fcBkdEdn ; 

ULONG lcbBkdEdn ; 

ULONG fcAfdEdn ; 

ULONG lcbAfdEdn ; 

ULONG fcAfd ; 

ULONG lcbAfd ; 


} fibRgFcLcb2003; 

} 

if (file . fib . cbRgFcLcb == 136)//101-88 

{ 

struct FibRgFcLcb2002 

{ 


struct FibRgFcLcb2000 rgFcLcb2000; 
ULONG fcUnusedl; 

ULONG lcbUnusedl; 

ULONG fcPlcfPgp; 

ULONG lcbPlcfPgp; 



ULONG fcPlcfuim; 

ULONG lcbPlcf uim; 

ULONG fcPlfguidUim; 

ULONG lcbPlfguidUim; 

ULONG fcAtrdExtra; 

ULONG lcbAtrdExtra; 

ULONG fcPlrsid ; 

ULONG lcbPlrsid ; 

ULONG f cSttbf BkmkFactoid ; 
ULONG lcbSttbf BkmkFactoid; 
ULONG fcPlcfBkf Factoid; 

ULONG lcbPlcf Bkf Factoid; 
ULONG fcPlcf cookie; 

ULONG lcbPlcf cookie; 

ULONG fcPlcf BklFactoid ; 

ULONG lcbPlcf BklFactoid; 
ULONG fcFactoidData; 

ULONG lcbFactoidData; 

ULONG fcDocUndo; 

ULONG lcbDocUndo; 

ULONG fcStbfBkmkFcc; 

ULONG lcbStbf BkmkFcc ; 

ULONG fcPlcfBkfFcc; 

ULONG lcbPlcf Bkf Fee; 

ULONG fcPlcf BklFcc ; 

ULONG lcbPlcf BklFcc; 

ULONG f cSttbf bkmkBPRepairs; 
ULONG lcbSttbf bkmkBPRepairs; 
ULONG fcPlcfbkfBPRepairs; 
ULONG lcbPlcf bkf BPRepairs; 
ULONG fcPlcf bklBPRepairs ; 
ULONG lcbPlcf bklBPRepairs; 
ULONG fcPmsNew; 

ULONG lcbPmsNew; 

ULONG fcODSO; 

ULONG lcbODSO; 

ULONG fcPlcfpmiOldXP; 

ULONG lcbPlcf pmiOldXP; 

ULONG fcPlcfpmiNewXP; 

ULONG lcbPlcf pmiNewXP; 

ULONG fcPlcf pmiMixedXP ; 

ULONG lcbPlcf pmiMixedXP; 
ULONG fcUnused2; 

ULONG lcbUnused2; 

ULONG fcPlcf factoid; 

ULONG lcbPlcf factoid; 

ULONG fcPlcflvcOldXP; 

ULONG lcbPlcf IvcOldXP; 

ULONG fcPlcflvcNewXP; 

ULONG lcbPlcf IvcNewXP; 

ULONG fcPlcf IvcMixedXP ; 

ULONG lcbPlcf IvcMixedXP; 

} fibRgFcLcb2002; 

} 

if (file. fib. cbRgFcLcb == 108)//D9-6C 

{ 


struct FibRgFcLcb2000 
{ 



struct FibRgFcLcb97 rgFcLcb97; 
ULONG fcPlcfTch ; 

ULONG lcbPlcfTch ; 

ULONG fcRmdThreading; 

ULONG lcbRmdThreading; 

ULONG fcMid ; 

ULONG lcbMid ; 

ULONG fcSttbRgtplc; 

ULONG lcbSttbRgtplc ; 

ULONG fcMsoEnvelope; 

ULONG lcbMsoEnvelope; 

ULONG fcPlcf Lad ; 

ULONG lcbPlcfLad; 

ULONG fcRgDof r ; 

ULONG lcbRgDof r ; 

ULONG fcPlCOSl; 

ULONG lcbPlcosl; 

ULONG fcPlcf CookieOld ; 

ULONG lcbPlcf CookieOld; 

ULONG fcPgdMotherOld ; 

ULONG lcbPgdMotherOld ; 

ULONG fcBkdMotherOld ; 

ULONG lcbBkdMotherOld ; 

ULONG fcPgdFtnOld ; 

ULONG lcbPgdFtnOld; 

ULONG fcBkdFtnOld ; 

ULONG lcbBkdFtnOld ; 

ULONG fcPgdEdnOld ; 

ULONG lcbPgdEdnOld ; 

ULONG fcBkdEdnOld ; 

ULONG lcbBkdEdnOld ; 

} fibRgFcLcb2000; 

} 

if (file. fib. cbRgFcLcb == 93)//cl-5d 

{ 

struct FibRgFcLcb97 

{ 


ULONG fcStshfOrig ; 
ULONG lcbStshfOrig ; 
ULONG fcStshf ; 

ULONG lcbStshf ; 

ULONG fcPlcffndRef ; 
ULONG lcbPlcff ndRef ; 
ULONG fcPlcff ndTxt ; 
ULONG lcbPlcff ndTxt; 
ULONG fcPlcfandRef ; 
ULONG lcbPlcf andRef; 
ULONG fcPlcfandTxt ; 
ULONG lcbPlcf andTxt; 
ULONG fcPlcf Sed ; 
ULONG lcbPlcf Sed; 
ULONG fcPlcPad ; 

ULONG lcbPlcPad; 
ULONG fcPlcfPhe; 
ULONG lcbPlcfPhe; 
ULONG fcSttbfGlsy; 
ULONG lcbSttbfGlsy; 
ULONG fcPlcfGlsy; 



ULONG lcbPlcfGlsy; 

ULONG fcPlcf Hdd ; 

ULONG lcbPlcf Hdd ; 

ULONG fcPlcBteChpx; 

ULONG lcbPlcBteChpx; 

ULONG fcPlcBtePapx; 

ULONG lcbPlcBtePapx; 

ULONG fcPlcfSea; 

ULONG lcbPlcfSea; 

ULONG fcSttbf Ff n ; 

ULONG lcbSttbfFfn; 

ULONG fcPlcfFldMom; 

ULONG lcbPlcf FldMom; 

ULONG fcPlcf FldHdr ; 

ULONG lcbPlcf FldHdr; 

ULONG fcPlcf FldFtn; 

ULONG lcbPlcf FldFtn; 

ULONG fcPlcf FldAtn; 

ULONG lcbPlcf FldAtn; 

ULONG fcPlcf FldMcr ; 

ULONG lcbPlcf FldMcr; 

ULONG fcSttbfBkmk; 

ULONG lcbSttbfBkmk; 

ULONG fcPlcfBkf ; 

ULONG lcbPlcfBkf ; 

ULONG fcPlcfBkl; 

ULONG lcbPlcfBkl; 

ULONG fcCmds ; 

ULONG lcbCmds ; 

ULONG fcUnusedl; 

ULONG lcbUnusedl; 

ULONG fcSttbfMcr ; 

ULONG lcbSttbfMcr ; 

ULONG fcPrDrvr ; 

ULONG lcbPrDrvr ; 

ULONG fcPrEnvPort ; 

ULONG lcbPrEnvPort ; 

ULONG fcPrEnvLand ; 

ULONG lcbPrEnvLand ; 

ULONG fcWss ; 

ULONG lcbWss; 

ULONG fcDop; 

ULONG lcbDop; 

ULONG fcSttbf Assoc; 

ULONG lcbSttbf Assoc; 

ULONG fcClx; 

ULONG lcbClx; 

ULONG fcPlcPgdFtn; 

ULONG lcbPlcPgdFtn; 

ULONG fcAutosaveSource; 
ULONG lcbAutosaveSource; 
ULONG f cGrpXstAtnOwners ; 
ULONG lcbGrpXstAtnOwners; 
ULONG fcSttbfAtnBkmk; 
ULONG lcbSttbfAtnBkmk; 
ULONG fcUnused2; 

ULONG lcbUnused2; 

ULONG fcUnused3; 

ULONG lcbUnused3; 



ULONG fcPlcSpaMom; 

ULONG lcbPlcSpaMom; 

ULONG fcPlcSpaHdr ; 

ULONG lcbPlcSpaHdr ; 

ULONG fcPlcfAtnBkf ; 

ULONG lcbPlcfAtnBkf ; 

ULONG fcPlcAfAtnBkl; 

ULONG lcbPlcAfAtnBkl; 

ULONG fcPms ; 

ULONG lcbPms ; 

ULONG fcFormFldSttbs ; 

ULONG lcbFormFldSttbs ; 
ULONG fcPlcfendRef ; 

ULONG lcbPlcfendRef ; 

ULONG fcPlcfendTxt ; 

ULONG lcbPlcfendTxt ; 

ULONG fcPlcf FldEdn ; 

ULONG lcbPlcf FldEdn; 

ULONG fcUnused4; 

ULONG lcbUnused4; 

ULONG fcDgglnfo; 

ULONG lcbDgglnfo; 

ULONG fcSttbfRMark; 

ULONG lcbSttbfRMark; 

ULONG fcSttbf Caption; 

ULONG lcbSttbf Caption; 
ULONG fcSttbf AutoCaption; 
ULONG lcbSttbf AutoCaption; 
ULONG fcPlcfWkb; 

ULONG lcbPlcfWkb; 

ULONG fcPlcfSpl; 

ULONG lcbPlcf Spl; 

ULONG fcPlcf txbxTxt ; 

ULONG lcbPlcf txbxTxt; 

ULONG fcPlcfFldTxbx; 

ULONG lcbPlcf FldTxbx; 

ULONG fcPlcf HdrtxbxTxt ; 
ULONG lcbPlcf HdrtxbxTxt; 
ULONG fcPlcffldHdrTxbx; 
ULONG lcbPlcffldHdrTxbx; 
ULONG fcStwUser ; 

ULONG lcbStwUser ; 

ULONG fcSttbTtmbd ; 

ULONG lcbSttbTtmbd; 

ULONG fcCookieData; 

ULONG lcbCookieData; 

ULONG f cPgdMotherOldOld ; 
ULONG lcbPgdMotherOldOld ; 
ULONG f cBkdMotherOldOld ; 
ULONG lcbBkdMotherOldOld ; 
ULONG fcPgdFtnOldOld ; 

ULONG lcbPgdFtnOldOld ; 
ULONG fcBkdFtnOldOld ; 

ULONG lcbBkdFtnOldOld ; 
ULONG fcPgdEdnOldOld ; 

ULONG lcbPgdEdnOldOld ; 
ULONG fcBkdEdnOldOld ; 

ULONG lcbBkdEdnOldOld ; 
ULONG fcSttbf IntlFld ; 



ULONG lcbSttbf IntlFld ; 
ULONG fcRouteSlip; 

ULONG lcbRouteSlip; 

ULONG fcSttbSavedBy; 
ULONG lcbSttbSavedBy; 
ULONG fcSttbFnm; 

ULONG lcbSttbFnm; 

ULONG fcPlf Lst ; 

ULONG lcbPlf Lst ; 

ULONG fcPlf Lfo; 

ULONG lcbPlf Lfo; 

ULONG fcPlcfTxbxBkd; 
ULONG lcbPlcfTxbxBkd ; 
ULONG f cPlcfTxbxHdrBkd ; 
ULONG lcbPlcfTxbxHdrBkd ; 
ULONG fcDocUndoWord9; 
ULONG lcbDocUndoWord9 ; 
ULONG fcRgbUse; 

ULONG lcbRgbUse; 

ULONG fcUsp; 

ULONG lcbUsp; 

ULONG fcUskf ; 

ULONG lcbUskf ; 

ULONG fcPlcupcRgbUse; 
ULONG lcbPlcupcRgbUse; 
ULONG fcPlcupcUsp; 

ULONG lcbPlcupcUsp; 

ULONG f cSttbGlsyStyle ; 
ULONG lcbSttbGlsyStyle ; 
ULONG fcPlgosl; 

ULONG lcbPlgosl; 

ULONG fcPlcocx; 

ULONG lcbPlcocx; 

ULONG fcPlcfBteLvc; 

ULONG lcbPlcfBteLvc; 
ULONG fcLowDateTime; 
ULONG lcbHighDateTime; 
ULONG fcPlcf LvcPrelO; 
ULONG lcbPlcf LvcPrelO; 
ULONG fcAsumy; 

ULONG lcbAsumy; 

ULONG fcPlcf Gram; 

ULONG lcbPlcfGram; 

ULONG fcSttbListNames; 
ULONG lcbSttbListNames ; 
ULONG fcSttbfUssr ; 

ULONG lcbSttbfUssr ; 


} fibRgFcLcb97 ; 

} 

USHORT CSwNew; 

if (file. fib. cbRgFcLcb == 183) 

{ 

USHORT rgCswNewData2000 ; 
USHORT lidThemeOther ; 
USHORT lidThemeFE; 

USHORT lidThemeCS; 



} 

else 

{ 

USHORT cQuickSavesNew; 

} 


}fib; 

/*( = 18 ) 

{ 

//search table 1 

} 

else 

{ 

//searcj table 0 

}*/ 


}file; 



